TTL issue for pam_password with v2.0.0 about python-irodsclient

[peterverraedt]

you're sure it was being treated as 'hours' in 1.1.9? that seems... surprising.

https://github.com/irods/irods/blob/main/plugins/database/src/db_plugin.cpp#L7102

The number passed over the wire is multiplied by 3600, so it always has been hours. So this is the regression for the python client: by default v1 attempted to generate a native password with validity of 60 hours, and v2 takes the shorter 121 seconds from server side.

[korydraughn]

What version of the PRC are you using?
What version of iRODS are you experiencing this against?

[mstfdkmn]

What version of the PRC are you using?

>>> import irods
>>> irods.__version__
'2.0.0'

What version of iRODS are you experiencing this against?

>>> session.server_version
(4, 3, 1)

[korydraughn]

Oh right, the PRC version is in the title.

Anyway, have you adjusted your PAM TTL settings according to the following section?

• https://docs.irods.org/4.3.1/system_overview/configuration/#authentication-configuration

If yes, can you share what you have for each option?

[mstfdkmn]

these are:

[irods@gbiomed ~]$ iadmin get_grid_configuration authentication password_max_time
1209600
[irods@gbiomed ~]$ iadmin get_grid_configuration authentication password_min_time
121
[irods@gbiomed ~]$ iadmin get_grid_configuration authentication password_extend_lifetime
1

[peterverraedt]

The real issue here is that in the v1 client the default password lifetime is 60 hours
https://github.com/irods/python-irodsclient/blob/v1.1.9/irods/connection.py#L440
(although the naming of that variable is confusing).

In v2 the default is that the server should decide on the lifetime

python-irodsclient/irods/connection.py

Lines 461 to 462 in ed2e73c

	# By default, let server determine the TTL.
	time_to_live_in_hours = 0

apparently without possibility for the client to overwrite it and ask another value. And the default lifetime of the server is the minimal one, 121 seconds.

[trel]

Everything is more configurable with 'seconds', so that was the new standard - so I think that part is expected/desired.

[trel]

you're sure it was being treated as 'hours' in 1.1.9? that seems... surprising.

[korydraughn]

One thing that sticks out is the message at the end of stacktrace(?).

RuntimeError: Time To Live has expired for the PAM password, and no new password is given in legacy_auth.pam.password_for_auto_renew.  Please run iinit.

That is generated here:

python-irodsclient/irods/connection.py

Lines 475 to 477 in 1d8433e

	message = ('Time To Live has expired for the PAM password, and no new password is given in ' +
	'legacy_auth.pam.password_for_auto_renew. Please run iinit.')
	raise RuntimeError(message)

Seems you may want to review this section. There are several PAM related option described there and they are referenced in the code leading to that exception.

• https://github.com/irods/python-irodsclient/tree/v2.0.0?tab=readme-ov-file#python-irods-client-settings-file

[korydraughn]

See the following for the full function impl. Notice the lines starting from line 470.

python-irodsclient/irods/connection.py

Lines 457 to 480 in 1d8433e

	def _login_pam(self):
	import irods.client_configuration as cfg
	inline_password = (self.account.authentication_scheme == self.account._original_authentication_scheme)
	# By default, let server determine the TTL.
	time_to_live_in_hours = 0
	# For certain characters in the pam password, if they need escaping with '\' then do so.
	new_pam_password = PAM_PW_ESC_PATTERN.sub(lambda m: '\\'+m.group(1), self.account.password)
	if not inline_password:
	# Login using PAM password from .irodsA
	try:
	self._login_native()
	except (ex.CAT_PASSWORD_EXPIRED, ex.CAT_INVALID_USER, ex.CAT_INVALID_AUTHENTICATION):
	time_to_live_in_hours = cfg.legacy_auth.pam.time_to_live_in_hours
	if cfg.legacy_auth.pam.password_for_auto_renew:
	new_pam_password = cfg.legacy_auth.pam.password_for_auto_renew
	# Fall through and retry the native login later, after creating a new PAM password
	else:
	message = ('Time To Live has expired for the PAM password, and no new password is given in ' +
	'legacy_auth.pam.password_for_auto_renew. Please run iinit.')
	raise RuntimeError(message)
	else:
	# Login succeeded, so we're within the time-to-live and can return without error.
	return

[peterverraedt]

Actually correct code snippet is

https://github.com/irods/irods/blob/main/plugins/database/src/db_plugin.cpp#L7241-L7252

[korydraughn]

I think adding a settings file will allow you to make progress. The option you want to set in that file appears to be legacy_auth.pam.time_to_live_in_hours.

[korydraughn]

You may also need legacy_auth.pam.password_for_auto_renew.

[d-w-moore]

Confused with this. Btw, we don't use the native authentication in our flow.

Note this line too, showing that eventually _login_pam routes through _login_native anyway, with a transformed value it receives from the server, as part of its own internal workings. Yes , it's been that way for a while! : )

[mstfdkmn]

I am closing this - because we decided to use the native scheme. And apparently we are touching on an issue that existed in older versions.